See “Auditing” in the Security Administration Guide for encrypted columns auditing information (specifically Table 18-5, which lists the values in the event and extrainfo columns).